Exams / AIP-C01 / Study guide / Exposing retrieval to models as tools (function calling, MCP)
Exposing retrieval to models as tools (function calling, MCP): AIP-C01 study notes and practice questions
What to know about Exposing retrieval to models as tools (function calling, MCP) for the AIP-C01 exam, from the Foundation Model Integration, Data Management, and Compliance domain (31% of the exam guide), then 1 free question to test it. Part of the AIP-C01 study guide.
AIP-C01 asks how to give models access to search and internal data in a way that is reusable, secure and only used when it helps.
Two ways to expose retrieval
As a model tool. The model receives a tool definition for search through the Converse API tool use feature. It calls the tool only when the question needs company data, and the application runs the search and returns the results. This suits chat assistants and agents that also use other tools.
As a shared service. Several apps can call one standard retrieval API, or one Model Context Protocol server can expose search as a standard tool. Many agents and applications connect to the same server, so the search logic lives in one place. A lightweight, stateless MCP server fits AWS Lambda. A long-running or stateful one fits Amazon ECS, AWS Fargate or AgentCore Runtime.
Retrieve versus RetrieveAndGenerate
API
Returns
Choose when
Retrieve
Matching chunks with scores and metadata
Your application controls the prompt, the model, reranking or citations; or the model is a tool that reads chunks
RetrieveAndGenerate
A generated answer with citations
You want a managed answer quickly, generated by the model you name in the request
Designing the tool
Describe each parameter clearly, such as the query text, the number of results and an optional product category.
Cap parameters in the schema, for example a maximum result count, so the model cannot ask for thousands of chunks.
Return the source, title and date with each result so the model can cite it.
How to choose
Scenario wording
Choose
“Model should search only when a question needs company data”
Retrieval as a tool in Converse tool use
“Many agents share one search capability”
MCP server exposing search
“Turn an existing internal REST search API into an agent tool”
AgentCore Gateway with the API as an MCP tool
“App needs the raw chunks to build its own prompt”
Retrieve
“Fast managed answer with citations”
RetrieveAndGenerate
Access control
Per-user restrictions must be applied by the application or gateway, using the caller’s identity, as a metadata filter or a policy check. Never let the model supply the user ID or the department filter, because a prompt injection can change it. AgentCore Policy can check each tool call through the Gateway, outside the agent’s code.
Common traps
Letting the model choose the access filter, which a crafted prompt can override.
Building a custom MCP server on EC2 when AgentCore Gateway can expose an existing API.
Using RetrieveAndGenerate when the app must control the prompt or reranking.
Retrieval on every turn, including greetings, which wastes latency and tokens.
Unbounded result counts in the tool schema.
Sharing one broad credential across all tools instead of scoped identities.
A home goods retailer offers a shopping assistant that answers questions about return policies, shipping rules and warranties from its knowledge base.
Most customer messages are chitchat, order status requests or product questions that need no policy text. Searching the knowledge base on every message adds latency and cost, and it sometimes puts unrelated passages into the prompt.
The assistant should search only when a policy answer is needed, and the search must run through the same model call that decides the reply.
Which design meets these requirements?
Choose one answer.
AA. Run a knowledge base search on every user message, and always prepend the top 10 passages to the prompt, so that the model has policy context ready for any question.
BB. Paste the full text of all policy pages into the system prompt of every request, so that the model never needs to search and always sees the complete policies.
CC. Declare a search_policies tool in the Converse request, and let the model call it only when a policy answer is needed, with the application running the search.
DD. Fine-tune a model on the policy pages so that it memorizes the rules, and remove the knowledge base entirely, since the model will then answer policy questions without any search.
Show the answer and explanation
Answer: C
A. Wrong: Searching on every message is the behavior the team wants to stop, because it adds latency and cost to chitchat and order requests. Unrelated passages would still reach the prompt, so this option misses the requirement.
B. Wrong: The complete policy text is large, so every request would pay for those tokens, including the chitchat ones. This adds the cost and latency the team is trying to remove.
C. Right: Tool use lets the model decide per message whether to call the search, and the application runs the retrieval and returns results in the same conversation. Chitchat and order requests never trigger a search, which meets every requirement. Learn more: Call a tool with the Converse API (opens in a new tab)
D. Wrong: Fine-tuning does not reliably memorize policy wording, and policies change, so answers would drift from the current rules. Removing retrieval also loses the citations and freshness the assistant needs.
Explanation
Tool use lets the model call the policy search only when a message needs a policy answer, so most messages skip retrieval. The application runs the search and returns the results in the same conversation. Searching every time, putting all policies in the prompt and fine-tuning each add cost, drift or lost grounding.
Want more on Exposing retrieval to models as tools (function calling, MCP)? The 5 full-length practice sets have 5 more Exposing retrieval to models as tools (function calling, MCP) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study Exposing retrieval to models as tools (function calling, MCP)